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IN THE CLAIMS 
Amended claims follow: 

1 . (Currently Amended) A con5)Ut©r program tjroduct stored on a computer-readable 
mediran for controlling a computer to scan data accessible via an internet link for 
malware, said computer program product comprising: 

(i) address ideutifyitLg code operable to identify within currently held data at 
least one internet address associated with said currently held data; 

(ii) retrieving code operable to pre-emptively retrieve via said internet link 
addressed data that would be accessed by a user following said at least one internet 
address;-^ 

(iii) scanning code operable to scan said addressed data for malware; and 
fiv^ storing code operable to store result data ident ifyiTig at least addressed 

data in which malware was not found : 

wherein said addressed data is cached whe n it has been retrieved, 

2. (Cancelled) 

3. (Original) A computer program product as claimed in claim 1 , wherein said 
address identifying code is operable to search within said currently held data for string 
data having a format matching a pointer to an internet address, 

4. (Original) A computer program product as claimed in claim 1 , wherein said 
currently held data includes received e-mail messages. 

5. (Original) A computer program product as claimed in claim 1, wherein said 
scanning code is operable to seek to detect within said addressed data one or more of: 

computer viruses; 

worms; 

Trojafts; 
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banned computer programs; 
banned words; or 
banned images. 

6. (Original) A computer program product as claimed in claim 1, wh^n said 
computer is a firewall computer via which internet traffic is passed to a local computer 
network. 

7. (Cancelled) 

8. (Original) A computer program product as claimed in claim 1 , wherein if malware 
is detected within said addressed data, then one or more malware found actions are 
triggered, 

9. (Previously Presented) A computer program product as claimed in claim 1, 
wherein said malware found actions including at least one of: 

(i) preventing access to said currently held data; 

(ii) removing said at least one internet address from said currently held data; 

(iii) preventing access to said addressed dats^ 

(iv) removing said malware fix)m said addressed data to generate clean 
addressed data and supplying said clean addressed data in place of said addressed data; 

(v) blocking internet access by a computer detected to be seeldng to access 
said at least one intemet address^ 

10. (Ciwtently Amended) A method of scanning data accessible via an intemet link 
for malware, said method comprising the steps of: 

(i) identifying within currently held data at least one int^et address 
associated with said currently held data; 

(ii) pre-emptively retrieving via said intemet link addressed data that would be 
accessed by a user following said at least one intemet address;-^ 

(iii) scanning said addressed data for malwareiand 
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(iv) storing result data identifying at least addressed data in which malware 
was not found; 

wherein said addressed data is cached when it has been retrieved. 

11. (Cancelled) 

12. (Original) A method as claimed in claim 10, wherein said st^ of identifying 
incltides searching within said cuirently held data for stiing data having a fotjnat 
matching a pointer to an internet address. 

1 3 . (Original) A method as claimed in claim 1 0, wherein said currently held data 
includes received e-mail messages. 

14. (Original) A method as claimed in claim 10, wherein said step of scanning seeks 
to detect within said addresjsed data one or more of: 

computer viruses; 

wonns; 

Trojans; 

banned computer programs; 
banned words; or 
banned images. 

15. (Original) A method as claimed in claim 10, wherein said method is performed by 
a firewall computer via which internet trafiBc is passed to a local computer network. 

16. (Cancelled) 

17- (Original) A method as claimed in claim 10, wherein if malware is detected 
within said addressed data, then one or more malware found actions are triggered. 
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1 8. (Original) A method as claimed in claim 10, wherein said malware found actions 
including at least one of: 

(i) preventing access to said cuixently held data; 

(ii) removing said at least one internet address from said currently held data; 

(iii) preventing access to said addressed data; 

(iv) removing said malware from said addressed data to generate clean 
addressed data and supplying said clean addressed data in place of said addressed data; 

(v) blocking internet access by a computer detected to be seeking to access 
said at least one internet address. 

19. (Currently Amended) Apparatus for scanning data accessible via an internet link 
for malware, said apparatus comprising: 

(i) address identifying logic operable to identify witliin currently held data at 
least one internet address associated with said currently held data; 

(ii) retrieving logic operable to pre-emptively retrieve via said internet link 
addressed data that would be accessed by a user following said at least one intemet 
address;-a»d 

(iii) soaiming logic operable to scan said addressed data for malwarei^d 

(iv) storing logic operable to Store result data identifying at lea^ addressed 
data in which malware was not found: 

wherein said addressed data is cached when it h as been retrieved. 

20. (Cancelled) 

21 . (Original) Apparatus as claimed in claim 19, wherein said address identifying 
logic is operable to search within said currently held data for string data having a format 
matching a pointer to an intemet address. 

22. (Original) Apparatus as claimed in claim 19, wherein said currently held data 
includes received e-mail messages. 
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23. (Origin^) Apparatus as claimed in claim 19, wherein said scanning logic is 
operable to seek to detect within said addressed data one or more of: 

computer viruses; 

wonns; 

Trojans; 

banned computer programs; 
banned words; or 
banned images. 

24. (Original) Apparatus as claimed in claim 19, wherein said computer is a firewall 
computer via which internet traffic is passed to a local computer network. 

25. (Cancelled) 

26. (Original) Apparatus as claimed in claim 19, wherein if malware is detected 
within said addressed data, then one or more malware found actions are triggered. 

27. (Original) Apparatus as claimed in claim 19» wherein said malware found actions 
including at least one of: 

(i) preventing access to said currently held dat^ 

(ii) removing said at least one iutemet address from said currently held data; 

(iii) preventing access to said addressed data; 

(iv) removing said malware from said addressed data to generate clean 
addressed data and supplying said clean addressed data in place of said addressed data; 

(v) blocking internet access by a computer detected to be seeking to access 
said at least one internet address. 

28. (New) A computer program product as claimed in claim 1, wherein said currently 
held data is an e-mail and said internet address is an internet link emhedded in said e- 
mail. 
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29. (New) A computer program product as claimed in claim 1, wherein said currratly 
held data is a file and said internet address is an intemet link embedded in said file. 

30. (New) A computer program product as claimed in claim 8, wherein said malware 
found actions include removing said at least one internet address &om said currently held 
data. 

3 1 . (New) A computer program product as claimed in claim 1 , wherein addressed 
data determined to contain malware via said scan is cleaned and said clean addressed data 
is stored locally for access via said intemet address. 

32. (New) A computer program product as claimed in claim 1, wherein access to said 
addressed data is allowed if said result data associated with said addressed data identifies 
said addressed data as not containing malware and if said addressed data has not changed 
since it was last scanned. 
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